e0164ae30e
- rebase to upstream NSS 3.124 - backport ml-dsa support that is not upstream yet. - pick up in process patches upstream including eddsa - fix pss issues
171 lines
6.2 KiB
Diff
171 lines
6.2 KiB
Diff
# HG changeset patch
|
|
# User Robert Relyea <rrelyea@redhat.com>
|
|
# Date 1780440795 25200
|
|
# Tue Jun 02 15:53:15 2026 -0700
|
|
# Branch NSS_3_124_BRANCH
|
|
# Node ID b1208e88ea45bdc57d04ae64e6614eec7072bd7f
|
|
# Parent 7b631ae5c0693bdb28e9ee9a4171eee2d3d62d0a
|
|
nss-3.124-annocheck.fix.patch
|
|
|
|
diff --git a/lib/freebl/arcfour-amd64-gas.s b/lib/freebl/arcfour-amd64-gas.s
|
|
--- a/lib/freebl/arcfour-amd64-gas.s
|
|
+++ b/lib/freebl/arcfour-amd64-gas.s
|
|
@@ -1,11 +1,35 @@
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
+#
|
|
+# none of the functions are used as a target of an indirect call, so
|
|
+# it's safe to set IBT. If we ever need to put these at the end of a
|
|
+# function table pointer, then we should and ENDBR64 instructions as the
|
|
+# first instruction of each function. */
|
|
+# reference names are in /usr/include/elf.h
|
|
+ .section .note.gnu.property,"a"
|
|
+ .align 8
|
|
+ .long 1f - 0f # note_gnu_name_end - note_gnu_name
|
|
+ .long 4f - 1f # note_gnu_descriptor_end -note_gnu_descriptor
|
|
+ .long 5 # GNU_PROPERTY_TYPE_0
|
|
+0: #note_gnu_name
|
|
+ .string "GNU"
|
|
+1: #note_gnu_end
|
|
+ #note_gnu_descriptor
|
|
+ .align 8
|
|
+ .long 0xc0000002 # GNU_PROPERTY_X86_FEATURE_1_AND
|
|
+ .long 3f - 2f #note_gnu_flags_end - note_gnu_flags
|
|
+2: #note_gnu_flags
|
|
+ .long 0x3 # GNU_PROPERTY_X86_FEATURE_1_IBT = 1 |
|
|
+ # GNU_PROPERTY_X86_FEATURE_1_SHSTK = 2
|
|
+3: #note_gnu_flags_end
|
|
+ .align 8
|
|
+4: #note_gnu_descriptor_end
|
|
|
|
# ** ARCFOUR implementation optimized for AMD64.
|
|
# **
|
|
# ** The throughput achieved by this code is about 320 MBytes/sec, on
|
|
# ** a 1.8 GHz AMD Opteron (rev C0) processor.
|
|
|
|
.text
|
|
.align 16
|
|
diff --git a/lib/freebl/intel-aes.S b/lib/freebl/intel-aes.S
|
|
--- a/lib/freebl/intel-aes.S
|
|
+++ b/lib/freebl/intel-aes.S
|
|
@@ -1,12 +1,34 @@
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
-
|
|
+/* none of the functions are used as a target of an indirect call, so
|
|
+ * it's safe to set IBT. If we ever need to put these at the end of a
|
|
+ * function table pointer, then we should and ENDBR64 instructions as the
|
|
+ * first instruction of each function. */
|
|
+# reference names are in /usr/include/elf.h
|
|
+ .section .note.gnu.property,"a"
|
|
+ .align 8
|
|
+ .long 1f - 0f # note_gnu_name_end - note_gnu_name
|
|
+ .long 4f - 1f # note_gnu_descriptor_end -note_gnu_descriptor
|
|
+ .long 5 # GNU_PROPERTY_TYPE_0
|
|
+0: #note_gnu_name
|
|
+ .string "GNU"
|
|
+1: #note_gnu_end
|
|
+ #note_gnu_descriptor
|
|
+ .align 8
|
|
+ .long 0xc0000002 # GNU_PROPERTY_X86_FEATURE_1_AND
|
|
+ .long 3f - 2f #note_gnu_flags_end - note_gnu_flags
|
|
+2: #note_gnu_flags
|
|
+ .long 0x3 # GNU_PROPERTY_X86_FEATURE_1_IBT = 1 |
|
|
+ # GNU_PROPERTY_X86_FEATURE_1_SHSTK = 2
|
|
+3: #note_gnu_flags_end
|
|
+ .align 8
|
|
+4: #note_gnu_descriptor_end
|
|
.text
|
|
|
|
#define IV_OFFSET 256
|
|
|
|
/*
|
|
* Warning: the length values used in this module are "unsigned int"
|
|
* in C, which is 32-bit. When they're passed in registers, use only
|
|
* the low 32 bits, because the top half is unspecified.
|
|
diff --git a/lib/freebl/intel-gcm.S b/lib/freebl/intel-gcm.S
|
|
--- a/lib/freebl/intel-gcm.S
|
|
+++ b/lib/freebl/intel-gcm.S
|
|
@@ -1,14 +1,38 @@
|
|
# LICENSE:
|
|
# This submission to NSS is to be made available under the terms of the
|
|
# Mozilla Public License, v. 2.0. You can obtain one at http:
|
|
# //mozilla.org/MPL/2.0/.
|
|
################################################################################
|
|
# Copyright(c) 2012, Intel Corp.
|
|
+/* none of the functions are used as a target of an indirect call, so
|
|
+ * it's safe to set IBT. If we ever need to put these at the end of a
|
|
+ * function table pointer, then we should and ENDBR64 instructions as the
|
|
+ * first instruction of each function. */
|
|
+# reference names are in /usr/include/elf.h
|
|
+ .section .note.gnu.property,"a"
|
|
+ .align 8
|
|
+ .long 1f - 0f # note_gnu_name_end - note_gnu_name
|
|
+ .long 4f - 1f # note_gnu_descriptor_end -note_gnu_descriptor
|
|
+ .long 5 # GNU_PROPERTY_TYPE_0
|
|
+0: #note_gnu_name
|
|
+ .string "GNU"
|
|
+1: #note_gnu_end
|
|
+ #note_gnu_descriptor
|
|
+ .align 8
|
|
+ .long 0xc0000002 # GNU_PROPERTY_X86_FEATURE_1_AND
|
|
+ .long 3f - 2f #note_gnu_flags_end - note_gnu_flags
|
|
+2: #note_gnu_flags
|
|
+ .long 0x3 # GNU_PROPERTY_X86_FEATURE_1_IBT = 1 |
|
|
+ # GNU_PROPERTY_X86_FEATURE_1_SHSTK = 2
|
|
+3: #note_gnu_flags_end
|
|
+ .align 8
|
|
+4: #note_gnu_descriptor_end
|
|
+ .text
|
|
|
|
#if defined(DARWIN)
|
|
# define cdecl(s) _##s
|
|
#else
|
|
# define cdecl(s) s
|
|
#endif
|
|
|
|
#ifndef DARWIN
|
|
diff --git a/lib/freebl/mpi/mpi_amd64_common.S b/lib/freebl/mpi/mpi_amd64_common.S
|
|
--- a/lib/freebl/mpi/mpi_amd64_common.S
|
|
+++ b/lib/freebl/mpi/mpi_amd64_common.S
|
|
@@ -398,12 +398,37 @@ s_mpv_mul_add_vec64:
|
|
|
|
.L27:
|
|
movq %r9, %rax
|
|
ret
|
|
|
|
#ifndef DARWIN
|
|
.size s_mpv_mul_add_vec64, .-s_mpv_mul_add_vec64
|
|
|
|
+# Magic indicating IBT is allowed.
|
|
+# none of the functions are used as a target of an indirect call, so
|
|
+# it's safe to set IBT. If we ever need to put these at the end of a
|
|
+# function table pointer, then we should and ENDBR64 instructions as the
|
|
+# first instruction of each function.
|
|
+# reference names are in /usr/include/elf.h
|
|
+ .section .note.gnu.property,"a"
|
|
+ .align 8
|
|
+ .long 1f - 0f # note_gnu_name_end - note_gnu_name
|
|
+ .long 4f - 1f # note_gnu_descriptor_end -note_gnu_descriptor
|
|
+ .long 5 # GNU_PROPERTY_TYPE_0
|
|
+0: #note_gnu_name
|
|
+ .string "GNU"
|
|
+1: #note_gnu_end
|
|
+ #note_gnu_descriptor
|
|
+ .align 8
|
|
+ .long 0xc0000002 # GNU_PROPERTY_X86_FEATURE_1_AND
|
|
+ .long 3f - 2f #note_gnu_flags_end - note_gnu_flags
|
|
+2: #note_gnu_flags
|
|
+ .long 0x3 # GNU_PROPERTY_X86_FEATURE_1_IBT = 1 |
|
|
+ # GNU_PROPERTY_X86_FEATURE_1_SHSTK = 2
|
|
+3: #note_gnu_flags_end
|
|
+ .align 8
|
|
+4: #note_gnu_descriptor_end
|
|
+
|
|
# Magic indicating no need for an executable stack
|
|
.section .note.GNU-stack, "", @progbits
|
|
.previous
|
|
#endif
|